The National Institute of Standards and Technology (NIST) National Center for Cybersecurity Excellence (NCCOE) has released it's latest draft medical device related security document, entitled 'NIST Special Publication 1800-8 Cybersecurity Special Publication 1800-8 Securing Wireless Infusion Pumps - In Healthcare Delivery Organizations'. Authored by Gavin O'Brien, Sallie Edwards, Kevin Littlefield, Neil McNab, Sue Wang and Kangmin Zheng - the document is available as either a PDF or web-based artifact. Enjoy.
"Medical devices, such as infusion pumps, were once standalone instruments that interacted only with the patient or medical provider. With technological improvements designed to enhance patient care, these devices now connect wirelessly to a variety of systems, networks, and other tools within a healthcare delivery organization (HDO) – ultimately contributing to the Internet of Medical Things (IoMT)." - via the National Center for Cybersecurity Excellence (NCCOE)
Further proof that the End-Of-The-World-Is-Near: Microsoft Corporation's (NasdaqGS: MSFT) LinkedIn just released a new update for the Company's already slightly-suspicious mobile app that permits Bluetooth connectivity (for location tracking) to fellow LinkedIn members. Reportedly, the feature does not require the app to be running... What could possibly go wrong?
News of an interesting privacy related lawsuit, via Fortune writer Jeff John Roberts, is now swirling around personal electronics manufacturer Bose Corporation. Apparently, collecting data (and a viloation of the so-called Wire Tap Act (Codified in 18 U.S.C. §§ 2510-2522)) - through a companion app to the company's best-in-class noise canceling headphones, and the misuse thereof, is the gist... Stay Tuned. Hat Tip
"The complaint accuses Boston-based Bose of violating the WireTap Act and a variety of state privacy laws, adding that a person's audio history can include a window into a person's life and views. "Indeed, one’s personal audio selections – including music, radio broadcast, Podcast, and lecture choices – provide an incredible amount of insight into his or her personality, behavior, political views, and personal identity," says the complaint, noting a person's audio history may contain files like LGBT podcasts or Muslim call-to-prayer recordings." - via Fortune writer Jeff John Roberts
Ladies and Gentlemen, Girls and Boys: Behold the list of both United States Senators and United States House of Representatives that voted to sell out your personal information while online (i.e., your precious online privacy) for monetary gain.
Each surname noted below, possesses a link to that Senator or Representative's contact page, to make it super-easy to let them know what you think. Oh, and for you parents/grandparents, gaurdians this includes all data requests coming from your home, i.e., your children's' data will also be swept up in this nightmare maelstrom example of the surveillance state. Enjoy
Senate of the UNITED STATES of AMERICA
YEA -- 50
U.S. Senate Roll Call Votes 115th Congress - 1st Session
Question: On the Joint Resolution (S.J. Res. 34 )
HOUSE OF REPRESENTATIVES of the UNITED STATES OF AMERICA
YEA -- 215
McMorris Rodgers (R-WA)
Apparently, this product is now embedded in a wide range of devices (ranging from Apple Inc. to Dell Computers and more). I do architect & advise end-point security efforts in my work (agnostic that I am - I do not recommend individual products), but certainly not an embedded product in BIOS or EFI. Could it be rightly called 'The Self-Healing Endpoint of Privacy'? Has a meme been created? You be the judge - Me?, I'm going back to paper and pencil, air-gapped (of course - dammit, air-gaps are no guaranty of secure platforms either...). What to do. Tip o' the Hat.
General Chair for the Organizing Committe of the ACM Conference on Data and Appilication Security and Privacy - Gail-Joon Ahn - has issued a Call for Participation for the Confab. Slated for March 22, 2017 through and inclusive of March 24, 2017. THis is sure to be an outstanding conference, with both two outstanding keynotes (which can be found here: http://www.codaspy.org/keynotes/.
- General Chair: Gail-Joon Ahn, Arizona State University
- Program Co-Chairs: Gabriel Ghinita, University of Massachusetts at Boston, Alexander Pretschner, Technische Universität München
- Industry Track Chair: Elisa Bertino, Purdue University
- Poster Chair: Jaehong Park, University of Alabama in Huntsville
- Panel Chair: Adam Doupe, Arizona State University
- Proceedings Chairs: Martin Ochoa, Singapore University of Tech. and Design and Hongxin Hu, Clemson University
- Publicity and Web Chair: Ram Krishnan, UT San Antonio
- Workshop Chair: Adam Lee, University of Pittsburgh
- Local Chair: Ziming Zhao, Arizona State University
- Organization Chairs: Kristina Nelson, Arizona State University and
- Melissa Pagnozzi, Arizona State University
- Steering Committee: Ravi Sandhu, UT San Antonio (Co-Chair), Elisa Bertino, Purdue University (Co-Chair), Alexander Pretschner, Technische Universität München and Gail-Joon Ahn, Arizona State University
via the American Association for the Advancement of Science (AAAS), comes this important privacy-and-web-browsing-related press release wordsmithed by John Sullivan of Princeton, with the specific report by Arvind Narayanan, Ph.D., Professor of Computer Science, Princeton University, and Sharad Goel, Ph.D., an Assistant Professor at Stanford University, and others.
"Given a history with 30 links originating from Twitter, we can deduce the corresponding Twitter profile more than 50 percent of the time," the researchers note. "All the evidence we have seen piling up over the years showing the strong limits of data anonymization, including this study, really emphasizes the need to rethink our approach to privacy and data protection in the age of big data..." - via Sharad Goel, an Assistant Professor at Stanford University and an Author of the Study.
News, of Microsoft Corporation (NasdaqGS: MSFT) selling of customer telemetry on Windows 10 has come to light via Martin Kauffman on GHacks. Martin superlatively details the phenomenal audacity of Microsoft in the matter of selling usage information; and, while not surprising, just another indicator of the onerous feet-of-clay syndrome now evident in Redmond. Oh, and by-the-way, the data being shared is with a security firm, simply astounding. As always, you be the judge.
Well wrought thought piece on the use, and misuse, of prepaid cellular telephony hardware, the so-call Burner, and the effort to enforce regulations thereto. Entitled Burner Phones: Will Tightening Restrictions on Prepaid Cell Phones Solve Anything? Certainly today's Must Read post...
Thomas Fox-Brewster, writing at Forbes, regales us with the latest display of the demise of privacy: The formerly private records of 191,000,000 United States citizen's voting data, apparently yearning to be free, was granted it's wish and published in an on-line database of reportedly unknown origins... Available for consumption on our beloved interwebs. Astounding.
OpenALPR works well and fast, at least judging by the demo. It's also legal for the most part. As EFF lawyer Jennifer Lynch tells Ars Technica, "While a handful of states have passed laws explicitly restricting private citizens and companies from using ALPR technology, outside of those states, there is not much in the law that would prevent someone from using the technology unless its use rises to the level of stalking or harassment. License plates are exposed to public view, and ALPR companies like Vigilant consistently argue they have a First Amendment right to photograph plates and retain the data they collect." - via Michael Byrne, writing at Vice's Motherboard